CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

CVE-2019-11886

The WaspThemes Visual CSS Style Editor (also known as yellow-pencil-visual-theme-customizer ) plugin for WordPress is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in versions prior to 7.2.1 . The root cause is the application's failure to adequately verify that requests originate from a...